HTM 上没有输出，

Question

我运行下面的脚本和事件日志在 HTM 文件上是空白的，但在 powershell 上

$ServerListFile = "D:\Scripts\ServerList.txt"   
$ServerList = Get-Content $ServerListFile -ErrorAction SilentlyContinue  
$Result = @() 
ForEach($computername in $ServerList)  
 {
 Get-Eventlog -LogName Security -Newest 2000 | Where-Object {$_.EventID -eq     "4624"} | Select-Object @{Name ="Username"; Expression = {$_.ReplacementStrings[1]}} 
   $result += [PSCustomObject] @{  
    ServerName = "$computername" 
    EventLog = "$Username"
     }  
 $Outputreport = "<HTML><TITLE> Decommission Validation Report </TITLE> 
                 <BODY background-color:peachpuff> 
                 <font color =""#99000"" face=""Microsoft Tai le""> 
                 <H2> Decommission Validation Report </H2></font> 
                 <Table border=1 cellpadding=0 cellspacing=0> 
                 <TR bgcolor=gray align=center> 
                   <TD><B>Server Name</B></TD> 
                   <TD><B>EventLog</B></TD></TR>"
      Foreach($Entry in $Result)  
 {  
      if((($Entry.Servername) -or ($Entry.EventLog)) -ge 80 )  
      {  
        $Outputreport += "<TR bgcolor=red>"  
      }  
      else 
       { 
        $Outputreport += "<TR>"  
      } 
      $Outputreport += "<TD>$($Entry.Servername)</TD></TD><TD align=center>$($Entry.Username)</TD></TR>"  
    } 
 $Outputreport += "</Table></BODY></HTML>"  
    }
 $Outputreport | out-file D:\Scripts\Test.htm  
 Invoke-Expression D:\Scripts\Test.htm

我运行上面的脚本和事件日志在 HTM 文件上是空白的，但在 powershell 上

Answer 1

您没有捕获 get-eventlog return 值

ForEach($computername in $ServerList)  
 {
 $eventLog = Get-Eventlog -LogName Security -Newest 2000 | Where-Object {$_.EventID -eq     "4624"} | Select-Object @{Name ="Username"; Expression = {$_.ReplacementStrings[1]}} 
 $result += [PSCustomObject] @{  
 ServerName = "$computername" 
 EventLog = "$eventLog.Username"
 }

如果您想要的是每个 2k 事件日志项的结果条目 returned 则执行此操作：

ForEach($computername in $ServerList)  
{
$eventLog = Get-Eventlog -LogName Security -Newest 2000 | Where-Object {$_.EventID -eq     "4624"} | Select-Object @{Name ="Username"; Expression = {$_.ReplacementStrings[1]}} 
foreach($item in $eventLog)
  {
    $result += [PSCustomObject] @{  
    ServerName = "$computername" 
    EventLog = "$eventLog.Username"
    }  
  }

Answer 2

我采纳了 Dane Boulton 建议的更改并稍微修改了您的代码以获得我认为是您正在寻找的内容。我将替换字符串条目更改为 5，因为我相信您正在寻找登录的用户帐户。我还修改了 EventLog 变量以引用 $item.UserName。看看这对您有何帮助。

$ServerListFile = "D:\Scripts\ServerList.txt"   
$ServerList = Get-Content $ServerListFile -ErrorAction SilentlyContinue  
$Result = @() 
ForEach($computername in $ServerList)  
  {
  $eventLog = Get-Eventlog -LogName Security -Newest 2000 | Where-Object {$_.EventID -eq "4624"} | Select-Object @{Name ="Username"; Expression = {$_.ReplacementStrings[5]}} 
foreach($item in $eventLog)
  {
    $result += [PSCustomObject] @{  
    ServerName = $computername
    UserName = $item.Username
    }  
  }
     $Outputreport = "<HTML><TITLE> Decommission Validation Report </TITLE> 
               <BODY background-color:peachpuff> 
                     <font color =""#99000"" face=""Microsoft Tai le""> 
                     <H2> Decommission Validation Report </H2></font> 
                     <Table border=1 cellpadding=0 cellspacing=0> 
                     <TR bgcolor=gray align=center> 
                       <TD><B>Server Name</B></TD> 
                       <TD><B>UserName</B></TD></TR>"
          Foreach($Entry in $Result)  
     {  
          if((($Entry.Servername) -or ($Entry.UserName)) -ge 80 )  
          {  
            $Outputreport += "<TR bgcolor=red>"  
          }  
          else 
           { 
            $Outputreport += "<TR>"  
          } 
          $Outputreport += "<TD>$($Entry.Servername)</TD></TD><TD align=center>$($Entry.UserName)</TD></TR>"  
        } 
     $Outputreport += "</Table></BODY></HTML>"  
        }
     $Outputreport | out-file D:\Scripts\Test.htm  
     Invoke-Expression D:\Scripts\Test.htm

HTM 上没有输出，

Output not coming on HTM,

powershell

health-monitoring